CVE-2019-10141: openstack ironic-inspector SQL Injection

Vulnerability summary

CVE-2019-10141 is a critical (CVSS 9.1) SQL Injection vulnerability in openstack ironic-inspector. EPSS estimates a 2.48% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities.

Timeline

1. 30-07-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.